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Top Stories 

• DuPont officials reported November 29 that about 23,000 pounds of methyl mercaptan was 
released at the company’s La Porte, Texas chemical facility in November marking an 
increase from the company’s original estimate that 100 pounds of the gas was released. - 
Texas Tribune (See item 1) 

• An attacker group known as FIN4 has targeted high-level figures at various financial 
services companies, advisory firms, and regulators in order to obtain inside information on 
business decisions for possible use in stock trading since 2013. - Securityweek (See item 2 ) 

• A Nordstrom store in Chicago reopened November 30 after the retailer closed November 
28 following a domestic-related shooting inside the store that left one worker and the 
gunman dead. - Chicago Tribune (See item 19 ) 

• SP+ officials reported November 28 that hackers uploaded malware onto its servers 
accessing 17 parking facilities in Illinois, Ohio, Pennsylvania, and Washington, and warned 
customers that their personal data may have been compromised. - DNAinfo (See item 20 ) 
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Energy Sector 



Nothing to report 
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Chemical Industry Sector 

1. November 29, Texas Tribune - (Texas) DuPont says plant leaked 23,000 pounds of 
toxic gas. DuPont officials reported November 29 that about 23,000 pounds of methyl 
mercaptan was released inside a process building at the company’s La Porte chemical 
facility in November marking an increase from the company’s original estimate that 
100 pounds of the gas was released. Company officials revised its initial estimate after 
reviewing the amount of gas in the plant’s pipes and vessels before and after the 
incident, and updated its report to the Texas Commission on Environmental Quality. 
Source: http://www.texastribune.org/2014/ll/29/dupont-savs-plant-leaked-23000- 
pounds-toxic- gas/ 

T Return to top i 

Nuclear Reactors, Materials, and Waste Sector 

Nothing to report 
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Critical Manufacturing Sector 

Nothing to report 
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Defense Industrial Base Sector 

Nothing to report 
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Financial Services Sector 

2. December 1, Securityweek - (International) FIN4 attack group targets firms for 
stock market profit. FireEye researchers published a report on a group of attackers 
known as FIN4 that have targeted high-level figures at various financial services 
companies, advisory firms, and regulators in order to obtain inside information on 
business decisions for possible use in stock trading. The group has been active since 
mid-2013 and uses visual basic applications (VBA) macros in Microsoft Word 
documents and links to fake Outlook Web App login pages in order to obtain user 
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names and passwords. 

Source: http://www.securitvweek.com/fin4-attack-group-targets-firms-stock-market- 
profit 

For another story, see item 7 
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Transportation Systems Sector 

3. November 30, WALA 10 Mobile - (Florida) Train derailment off Highway 90 near 
Milton. A 3 mile section of Highway 90 in Santa Rosa County was expected to remain 
closed until December 1 when 20 of the 40 cars in a CSX train derailed November 30. 
Source: http://foxl0tv.eom/2014/l 1/30/ocso-train-derailed-on-santa-rosaokaloosa- 
county-line/ 

4. November 29, WPX1 11 Pittsburgh - (Pennsylvania) Delta flight makes emergency 
landing in Pittsburgh. A Delta Airlines flight en route to San Francisco from New 
York was forced to make an emergency landing at Pittsburgh International Airport 
November 29 when the crew detected a smoky odor in the vicinity of the aft galley. 

The aircraft was inspected at the airport and later continued on to its destination after 
the source of the odor was not found. 

Source: http://www.wpxi.com/news/news/local/delta-flight-makes-emergencv-landing- 
pittsburgh/njHym/ 

5. November 29, KMOV 4 St. Louis - (Missouri) MetroLink train and pickup truck 
crash injuring 21 people. Twenty-one people were injured and sent to the hospital for 
treatment when a MetroLink train collided with a pickup truck at the Central West End 
station in St. Louis November 29. 

Source: http://www.kmov.com/news/editors-pick/Metrolink-train-and-pickup-truck- 
collide-at-Central-West-End-station-284225841.html 

6. November 28, Associated Press - (Minnesota) Train derails near Mankato. Rail 
authorities were investigating after 6 cars of a Union Pacific train and 4 cars from a 
Canadian Pacific train derailed in Mankato November 28 when the 2 trains collided 
while one was crossing in front of the other. 

Source: http://www.kare! 1 .com/story/news/local/2014/1 1/27/train-derails-near- 
mankato-union-pacific/1 9582 195/ 

7. November 28, Securityweek - (International) 118 online airline fraud suspects 
arrested in international operation. Law enforcement agencies in several countries 
coordinated by Europol, Ameripol, and Interpol conducted a 2 day operation in 45 
countries that led to the arrest of 118 individuals who allegedly purchased airline 
tickets using stolen or fraudulent payment card data. 

Source: http://www.securityweek.com/118-online-airline-fraud-suspects-arrested- 
intemational-operation 
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For another story, see item 11 
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Food and Agriculture Sector 

8. November 28, WBBH 20 Fort Myers - (Florida) Thieves steal 500 boxes of tomatoes 
from Immokalee market. Police arrested a Collier County man November 27 for 
allegedly stealing $13,500 worth of produce, including 500 boxes of tomatoes, from the 
Sanchez Produce Market in Immokalee November 23. The suspect and two other 
accomplices were injured in a crash about 2 hours after the theft and a truck used 
during the theft overturned revealing the stolen produce. 

Source: http://www.nbc-2.com/storv/27502702/thieves-steal-500-boxes-of-tomatoes- 
from-immokalee-market 
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Water and Wastewater Systems Sector 

9. December 1, WHKY 14 Hickory - (North Carolina) Wastewater spill Friday in 
Hickory. City of Hickory officials reported that an estimated 435,000 gallons of 
untreated wastewater discharged November 28 from the Moose Club pumping station 
into Lake Hickory. The North Carolina Division of Water Resources is investigating 
the incident. 

Source: http://www.whkv.com/archive/item/4001-wastewater-spill-fridav-in-hickory 

10. November 29, Boston Globe - (Massachusetts) Ashland water main break pollutes 
town’s water. Water service was restored to 16,500 residents in Ashland, 
Massachusetts, after a water main break disrupted service overnight November 28. 
Officials found that the disruption was caused by a water main break that occurred in a 
main line near the Ashland-Framingham border. 

Source: http://www.boston.com/news/local/massachusetts/2014/ll/29/ashland-water- 
main-break-pollutes-town-water/6ZGPI7HarvDiQKvrTQ9uOFstory.html 

11. November 28, KNBC 4 Los Angeles - (California) Water restored to 100 homes after 
main break in Malibu. About 100 homes in Malibu, California, were without water 
service for nearly 24 hours following a large water main break November 27 that 
temporarily shut down lanes in both directions of Pacific Coast Highway between 
Broad Beach and the Trancas Canyon roads. All but one lane reopened 4 hours later 
and one westbound lane was expected to reopen December 1. 

Source: http://www.nbclosangeles.com/news/local/Water-Main-Break-Sinkhole-Shuts- 
PCH-in-Malibu-284 115971 .html 
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Healthcare and Public Health Sector 



12. November 28, WJAX 47 Jacksonville/WFOX 30 Jacksonville - (Florida) CVS in Lake 
Butler cleared after bomb threat hoax. A hoax bomb threat prompted the 3 hour 
evacuation of the CVS Pharmacy in Lake Butler November 28. Police searched the 
building and cleared the scene after nothing suspicious was found. 

Source: http://www.actionnewsiax.com/news/news/local/union-county-deputies- 
responding-incident-cvs-lake/niHSc/ 

For another story, see item 2 
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Government Facilities Sector 

Nothing to report 
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Emergency Services Sector 

13. December 1, KTBC 7 Austin - (Texas) APD HQ still closed after shooting spree. The 
Austin Police Department headquarters in Texas remained closed December 1 until 
further notice after a gunman opened fire on the building during a shooting spree where 
a bank, the federal courthouse, and the Mexican Consulate headquarters were all 
targeted and shot at November 28. 

Source: http://www.mvfoxaustin.com/storv/27514472/apd-hq-still-closed-after- 
shooting-spree 

14. November 29, WAVE 3 Louisville - (Kentucky) 2 inmates escape from Lexington 
minimum-security prison. Police in Kentucky are searching for two inmates who 
escaped from the Blackburn Correctional Complex November 29 after both walked 
away from the minimum-security prison. 

Source: http://www.wave3.com/storv/27508101/2-inmates-escape-from-lexington- 
minimum-security-prison 

15. November 29, Burlington Free Press; Associated Press - (Vermont) Behind the 911 
outage: 45 calls didn’t get through. FairPoint Communications reported November 
29 that the cause of a nearly 6 hour 9-1-1 phone system outage November 28 was the 
result of both a tree falling on a fiber line in New Hampshire and equipment failure. 
Vermont officials determined 45 emergency calls were unable to go through during the 
outage. 

Source: http://www.buiiingtonfreepress.eom/storv/news/local/2014/l 1/29/vt-works- 
contact-callers-outage/19669513/ 
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Information Technology Sector 



16. December 1, IDG News Service - (International) Officials seize 292 domain names to 
protect consumers during holiday season. U.S. authorities, Europol, and law 
enforcement agencies in 19 countries seized 292 domain names as part of a coordinated 
operation to shut down Web sites selling counterfeit goods in order to protect 
consumers, Europol reported December 1. 

Source: http://www.networkworld.com/article/2853714/officials-seize-292-domain- 
names-to-protect-consumers-during-holidav-season.html 

Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 



17. November 28, Broadcasting & Cable - (Utah) FCC dials up $35,000 fine for 

Newport. Newport Television of Salt Lake City was fined $35,000 by the U.S. Federal 
Communications Commission for broadcasting a private phone conversation in a news 
report without first telling the person that the call was being recorded and would be 
broadcast. 

Source: http://www.broadcastingcable.com/news/washington/fcc-dials-3500Q-fine- 
newport/135978 
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Commercial Facilities Sector 

18. December 1, Securityweek - (International) Cybercriminals testing new PoS 
malware 'Poslogr'. Researchers with Trend Micro detected a new, multicomponent 
point-of-sale (PoS) malware dubbed TSPY_POSLOGR.K that is under development 
and yields similarities to a recently discovered variant of the BlackPoS malware. 
Poslogr is designed to read the memory linked to specific processes and collect 
payment card information, and researchers continue to work towards identifying which 
processes are scanned by the malware. 

Source: http://www.securitvweek.com/cvbercriminals-testing-new-pos-malware- 
poslogr 

19. November 30, Chicago Tribune - (Illinois) Two days after fatal shooting, Nordstrom 
again opens its doors. The Nordstrom store at the Shops at North Bridge mall in 
Chicago reopened November 30 after the retailer closed following a dome Stic -related 
shooting inside the store November 28. The shooter fatally wounded one worker before 
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he died of a self-inflicted gunshot wound. 

Source: http://www.chicagotribune.com/news/local/breaking/chi-chicago-nordstrom- 
shooting-murder-20 1411 30-story.html 

20. November 29, DNAinfo - (National) Data breach reported at Chicago, Evanston 
parking garages. Representatives from SP+, a parking garage management company, 
reported November 28 that hackers uploaded malware onto its servers accessing 17 
parking facilities in Illinois, Ohio, Pennsylvania, and Washington, and warned 
customers who used payment cards at the locations on specific dates that their personal 
information may have been compromised. The malware which is believed to have been 
installed via a remote access tool has since been disabled. 

Source: http://www.dnainfo.com/chicago/20141129/downtown/data-breach-reported- 
at-chicago-evanston-parking-garages 

21. November 28, WJAC 6 Johnstown - (Pennsylvania) Bomb threat of Elk County 
Walmart causes evacuation. A Walmart in Elk County was evacuated and closed for 
several hours November 28 while police investigated a bomb threat that was phoned 
into the store. Authorities determined the threat was unfounded but continue to 
investigate. 

Source: http://www.wiactv.com/news/features/top-stories/stories/bomb-threat-elk- 
county-walmart-causes-evacuation-4396.shtml 
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Dams Sector 

Nothing to report 
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DHS Daily Open Source Infrastructure Report Contact Information 



About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailyReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support @ govdelivery.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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